Interview of David Robin
summary
European Cyber Resilience Act takes mobile apps video games and some websites into scope and requires disclosing applicable vulnerabilities with enforcement starting in about 21 months causing real operational work not just policy. Obligations include keeping a software bill of materials, tracking every distributed binary, providing updates and a 5-year warranty for security fixes, keeping an audit trail and access controls, and facing penalties if hidden flaws are later exploited. Small studios struggle but tools like jrog already offer release lifecycle, SBOM generation and automated disclosure workflows.
AI-written summary · about
chapters (7)
- 0:00Welcome
- 1:39Cyber Resilience Act
- 3:45CVE notifications impact
- 6:37Compliance steps
- 8:46Small companies challenges
- 9:51JFrog compliance help
- 10:12Closing remarks
related talks
44mThey're coming to regulate you!
53mThe EU CRA Readiness for Contributors and Maintainers : A Survival Toolkit
27m4 Panel Session - Bridging Policy and Practice
25mSecure or Sorry: Your software is now a European Product
22mEU Cyber Resilience Act - A Product Owner’s Approach
23mDigital Products in Europe in the Face of the Cyber Resilience Act (CRA)
59mMerging Security and Compliance: Perspectives on Emerging Regulations and Best Practices
39mCherry Blossom and Compliance - An Intro To the EU CRA